CVE-2014-3341: Infoleak

Q: What is the severity of CVE-2014-3341?

CVE-2014-3341 is considered a medium severity vulnerability that allows attackers to enumerate VLANs.

Q: How do I fix CVE-2014-3341?

To fix CVE-2014-3341, upgrade Cisco NX-OS to a version that is later than 7.0(3)N1(1).

Q: What types of devices are affected by CVE-2014-3341?

CVE-2014-3341 affects Cisco Nexus 5000 and 6000 series devices running vulnerable versions of NX-OS.

Q: Can CVE-2014-3341 be exploited remotely?

Yes, CVE-2014-3341 can be exploited remotely by attackers sending specific SNMP requests.

Q: What is the impact of CVE-2014-3341 on network security?

The impact of CVE-2014-3341 is that it allows unauthorized users to gather information about VLAN configurations, which can lead to further attacks.

Published Aug 19, 2014

Updated

The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

Affected Software

52 affected components

Cisco NX-OS<=7.0\(3\)n1\(1\)

Cisco NX-OS=5.0\(2\)n1\(1\)

Cisco NX-OS=5.0\(2\)n2\(1\)

Cisco NX-OS=5.0\(2\)n2\(1a\)

Cisco NX-OS=5.0\(3\)n1\(1c\)

Cisco NX-OS=5.0\(3\)n2\(1\)

Cisco NX-OS=5.0\(3\)n2\(2\)

Cisco NX-OS=5.0\(3\)n2\(2a\)

Cisco NX-OS=5.0\(3\)n2\(2b\)

Cisco NX-OS=5.1\(3\)n1\(1\)

Cisco NX-OS=5.1\(3\)n1\(1a\)

Cisco NX-OS=5.1\(3\)n2\(1\)

Cisco NX-OS=5.1\(3\)n2\(1a\)

Cisco NX-OS=5.1\(3\)n2\(1b\)

Cisco NX-OS=5.1\(3\)n2\(1c\)

Cisco NX-OS=5.2\(1\)n1\(1\)

Cisco NX-OS=5.2\(1\)n1\(1a\)

Cisco NX-OS=5.2\(1\)n1\(1b\)

Cisco NX-OS=5.2\(1\)n1\(2\)

Cisco NX-OS=5.2\(1\)n1\(2a\)

Cisco NX-OS=5.2\(1\)n1\(3\)

Cisco NX-OS=5.2\(1\)n1\(4\)

Cisco NX-OS=5.2\(1\)n1\(5\)

Cisco NX-OS=5.2\(1\)n1\(6\)

Cisco NX-OS=5.2\(1\)n1\(7\)

Cisco NX-OS=5.2\(1\)n1\(8\)

Cisco NX-OS=5.2\(1\)n1\(8a\)

Cisco NX-OS=6.0\(2\)n1\(2\)

Cisco NX-OS=6.0\(2\)n1\(2a\)

Cisco NX-OS=6.0\(2\)n2\(1\)

Cisco NX-OS=6.0\(2\)n2\(1b\)

Cisco NX-OS=6.0\(2\)n2\(2\)

Cisco NX-OS=6.0\(2\)n2\(3\)

Cisco NX-OS=6.0\(2\)n2\(4\)

Cisco NX-OS=6.0\(2\)n2\(5\)

Cisco NX-OS=7.0\(0\)n1\(1\)

Cisco NX-OS=7.0\(1\)n1\(1\)

Cisco NX-OS=7.0\(2\)n1\(1\)

Cisco Nexus 5000

Cisco Nexus 5010

Cisco Nexus 5010p Switch

Cisco Nexus 5020

Cisco Nexus 5020p Switch

Cisco Nexus 5548p

Cisco Nexus 5548up

Cisco Nexus 5596t

Cisco Nexus 5596up

Cisco Nexus 56128p

Cisco Nexus 5672up

Cisco Nexus 6001

Cisco Nexus 6004

Cisco Nexus 6004x

Event History

Aug 19, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3341?

CVE-2014-3341 is considered a medium severity vulnerability that allows attackers to enumerate VLANs.

How do I fix CVE-2014-3341?

To fix CVE-2014-3341, upgrade Cisco NX-OS to a version that is later than 7.0(3)N1(1).

What types of devices are affected by CVE-2014-3341?

CVE-2014-3341 affects Cisco Nexus 5000 and 6000 series devices running vulnerable versions of NX-OS.

Can CVE-2014-3341 be exploited remotely?

Yes, CVE-2014-3341 can be exploited remotely by attackers sending specific SNMP requests.

What is the impact of CVE-2014-3341 on network security?